1. Technical Field
The invention disclosed broadly relates to the data processing and more particularly relates to intelligent realtime monitoring.
2. Background Art
This invention is related to the copending U.S. patent application Ser. No. 08/138/045 filed Oct. 5, 1993 by P. C. Hershey, et al. entitled "System and Method for Adaptive, Active Monitoring of a Serial Data Stream Having a Characteristic Pattern," assigned to the IBM Corporation and incorporated herein by reference.
This invention is related to the copending U.S. patent application Ser. No. 08/024,542, now U.S. Pat. No. 5,365,514 filed May 1, 1993 by J. G. Waclawsky, et al., entitled "System and Method for Configuring an Event Driven Interface and Analyzing Its Output for Monitoring and Controlling a Data Communications Network," assigned to the IBM Corporation and incorporated herein by reference. The Waclawsky, et al. patent application describes an information collection architecture which allows the conversion of signals in a data communications network bit stream, to be fed back into a monitoring and controlling system to assess and to modify protocol activity for a variety of communications protocols. The protocols handled include Token Ring protocol, ETHERNET protocol, Fiber Distributed Data Interface (FDDI) protocol, System Network Architecture (SNA) protocols, TCP/IP protocols, and SONET protocol, among others.
An example of this is for a token ring performance architecture described in greater detail in copending U.S. patent application Ser. No. 08/024,575, now U.S. Pat. No. 5,375,070 filed Mar. 1, 1993 by P. C. Hershey, et al. entitled "Event Driven Interface for a System for Monitoring and Controlling a Data Communications Network," assigned to IBM Corporation and incorporated herein by reference. This reference describes an expert system driven implementation that constructs a control vector C(i) which is transmitted to a programmable performance vector generator which includes an Event Driven Interface (EDI). The control vector tells the EDI how to organize its logic trees based on the type of protocol being run on a network. The control vector will configure the EDI logic trees to perform digital filtering of binary bit sequences on the network which characterize the protocol, the performance, and from which problem determination information can be inferred. The expert system will specify a format for an event vector E(i) that will be generated by the Event Driven Interface within the Programmable Performance Vector Generator (PPVG), that will provide the requested information characterizing the current condition of the network. The expert system then analyzes the information in the event vector and drives control functions which enable control signals to be issued to the network to modify network load, perform load balancing and load distribution, do problem determination, modify network routing, or to provide other customer services. The expert system can issue control vectors C(i) to collect additional information to perform problem determination and analysis to identify and analyze temporary failures and performance degradation on the network. The expert system can perform performance monitoring to identify when a performance factor of a network component exceeds a predefined threshold. The expert system can perform benchmark testing of an application running on the network with respect to its functions, reliability and performance objectives. The expert system can initiate performance tuning and optimization of the network to improve the efficiency of the network or other network components. The expert system can perform a workload analysis and prepare a report to identify both application and protocol-related workloads, i.e., how much network traffic is useful information and how much is protocol-related, where the noisiest nodes are in the network and the amount of incoming and outgoing traffic flow to the network. The expert system can provide network sizing information to guarantee a workable solution for a particular customer application, based upon forecast traffic patterns. The expert system can provide input information for load balancing, load distribution and network control. The principle of operation of the expert system and Programmable Performance Vector Generator combination is also applied, to additional communications protocols such as Ethernet protocol, FDDI protocol, SNA protocols, TCP/IP protocols or the SONET protocol.
The invention finds application within the Information Collection Architecture which is further described in the above referenced Waclawsky, et al. patent application. The Information Collection Architecture extracts information characterizing all data communications network environments, especially those that are high speed and/or complex network environments. The Information Collection Architecture is an enabler that provides a unique physical layer based window into both physical and logical network activity. It can significantly improve the functions, and services and management of any data communications network. It is independent of communications protocols, standards, and physical media. The Information Collection Architecture invention is physically connected to an existing data communications network to monitor the high speed messages which are transferred over the network. The Information Collection Architecture includes a feedback connection which can be used to provide control signals back to the data communications network to modify the behavior of the network in response to monitoring data messages on the network. The Information Collection Architecture performs the functions of real-time identification of events which occur on the network and prepares summaries of correlated event behavior from the network. The Information Collection Architecture provides correlated data and does not go through any data decompression or reconstruction process. This differs from prior techniques of data compression and sampling. The Information Collection Architecture invention performs an examination of only the frequency of occurrence of selected bit patterns, unlike prior trace techniques which require processing for the examination of all network data to determine performance metrics. The Information Collection Architecture permits all traffic to be monitored so that no information goes unseen, which is distinct from prior filtering techniques which permit only a portion of the network traffic to reach the network monitor for analysis. The Information Collection Architecture includes an organized collection of hybrid data reduction vectors and their associated services. These services include performance monitoring, performance tuning and optimization, benchmarking, problem determination, workload analysis and reporting, network sizing, load balancing, load distribution, network control, network accounting and network management functions. These services are provided for a large variety of data communications networks.
It would be useful to provide a means for establishing benchmarks for the behavior of data communications networks so that valid criteria can be made available to the expert system of the Information Collection Architecture to enable the monitoring and controlling of the data communications network based upon relevant standards of behavior for the network.